<!DOCTYPE HTML>
<meta charset="utf-8">
<title>Origin-Policy malformed headers must cause network errors</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="../resources/origin-policy-test-runner.js"></script>

<div id="log"></div>

<script>
"use strict";

[
  ``,
  `latest`,
  `allowed, preferred`,
  `"1"`,
  `allowed="1"`,
  `allowed=latest`,
  `allowed=()`,
  `allowed=("")`,
  `allowed=("1" ?0)`,
  `allowed=("1" 42)`,
  `allowed=("1" 2.5)`,
  `allowed=("1" :cHJldGVuZCB0aGlzIGlzIGJpbmFyeSBjb250ZW50Lg==:)`,
  `preferred=("1")`,
  `preferred=latest`,
  `preferred=""`,
  `preferred=?0, allowed=(latest)`,
  `preferred=latest-from-network, allowed=("1" ?0)`,
  `preferred="", allowed=(latest)`,
  `preferred=latest-from-network, allowed=("1", "")`,
].forEach(runTest);

function runTest(header) {
  async_test(t => {
    const iframe = document.createElement("iframe");
    iframe.src = "resources/subframe-with-bad-header.py?header=" + encodeURIComponent(header);

    iframe.onload = t.step_func_done(() => {
      // The loaded result must be cross-origin since it's a network error.
      // Accessing the document property of a cross-origin Window throws a
      // "SecurityError" DOMException.
      assert_throws_dom("SecurityError", () => iframe.contentWindow.document);
    });
    iframe.onerror = t.unreached_func("Iframe loads must not error");

    document.body.append(iframe);
  }, header);
}
</script>
